IMTI | Craig Johnston

145 2026-08-24 · 12 MIN · LONG-FORM

Don't Sandbox Python. Embed Starlark.

starlark-go in a Go server: FileOptions, host bindings, and a cancel watchdog

Craig Johnston · MCP / Go / Agents / Starlark / Python / Security / Data / SDLC

Latest note · folio diagram

flowchart TB
  subgraph vault["hermetic: no clock, no filesystem, no network"]
    direction TB
    SRC(["saved source"])
    TH{{"starlark.Thread<br/>step cap and watchdog"}}
    PRE[["predeclared<br/>platform  json  date  run"]]
    SRC --> TH
    TH -->|"ExecFileOptions"| PRE
  end
  PRE -->|"the only door"| CALL{"Caller.CallTool"}
  CALL -->|"in-memory session"| SRV[("assembled MCP server")]
  SRV --> WH[("warehouse")]
  SRV --> API[/API/]
  PRE -->|"export / publish_data"| KEY[["script:id:name"]]
  KEY --> DOC[/"versioned document"/]
  R(["reader"]) -.->|"bytes, no query"| DOC

Agents write good reports and dashboards. They also write good code. The gap is a runtime for that code after the conversation ends: query the warehouse or invoke an API, write the document, do it again on Monday, with …

Current Series

START HERE · 4 SERIES

28 NOTES

Advanced Platform Development

Rebuilding a complete self-hosted data platform from FOSS on Kubernetes, one working component at a time.

→ Start here

20 NOTES

MCP Without the SDK

The Model Context Protocol taken apart one JSON message at a time, written by hand in Go.

→ Start here

5 NOTES

MCP Studies

Measured studies of MCP agent behavior: knowledge-layer ablation, stored-knowledge use, the measurement harness, knowledge pollution, and cross-reference document completion.

→ Start here